Note: Descriptions are shown in the official language in which they were submitted.
Background of the Invention
21~51576
This invention relates to the protection of computer
software, and more particularly to a combination of software and
hardware components which software when executed in a prescribed
manner generates first and second keys which when processed by
an algorithm decoder produce a control key used to protect the
software from unauthorized use.
Hardware protected software programs are generally sold
to end users who receive a distribution diskette containing the
desired program and a hardware device which contains a matching
key. In order to operate the software, the supplied hardware
portion is plugged into a specified port of the computer
establishing a communications path between the hardware device
and the computer. If the hardware contains the correct code
which constitutes the key for that matching piece of software,
then the software is allowed to continue. Of course, the wrong
key or the absence of such a key prevents the operation of the
software. Copies of the software can be duplicated easily
permitting backup copies to be made. However, much effort is
spent in the industry to prevent the unauthorized duplication of
the hardware or otherwise emulating the hardware by making the
algorithm producing the key difficult to decode which prevents
or deters the unauthorized use of multiple copies without an
identical key for each identical copy.
2051S~6
In order to facilitate mass distribution of software by
the developer, the software is replicated en masse without
regard to individualization. Accordingly, hardware devices are
generally supplied identically, but under the manufacturer's
control and distribution. Each device contains a code that is
unique to a given piece of software or application product. If
it is desired to purchase additional but different types of
software, other unique coded hardware devices must be supplied
for each of the protected software applications or new version
of software, which eventually presents a problem in logistics.
First, the end user begins to acquire a multitude of
hardware units which must generally share the same port as well
as increasing the volume of space required to store all of the
hardware as well as the time consumed in properly identifying
them and associating them with each piece of software. Second,
in the event that other modules or software that work in
conjunction with the original distributed software are acquired
at a later time, additional keys must be obtained which may
impose further distribution problems. Third, for many reasons,
such as registering the rightful owner of the original software,
providing updates and other marketing and economic reasons,
software developers have resorted to serialization of the
software per se at the time of manufacture as well as requiring
mail-in registration cards for verification and control of the
legal end use of the product. Serialization of the software
requires special handling and equipment and presents problems of
logistics. The present invention is directed to the
2051576
amelioration of these problems which still permit mass
replication of the software desired to be protected while
preventing the unauthorized use of such software.
Summary of the Invention
Accordingly, it is an object of the present invention
to provide a new and improved method and apparatus for
protecting one or more copies of computer software in a unique
and beneficial manner.
Another object of this invention is to provide a new
and improved method and apparatus of protecting computer
software which may utilize many dissimilar keys for operating
the same software.
Another object of this invention is to provide a new
and improved method and apparatus for protecting computer
software which eliminates the need for requiring a multitude of
hardware units which generally share the same computer port for
the protection of related software programs.
Still another object of this invention is to provide a
new and improved method and apparatus for protecting computer
software which eliminates the need for providing additional keys
for use with software or other modules that work in conjunction
with previously distributed software and further, eliminates the
2051576
- 4
necessity of serialization of the software thereby reducing
the requirement of special handling for such serialization by
the manufacturer.
Still another object of the present invention is to
provide a new and improved method and apparatus for the
protection of computer software of the multiple or related
copy types which is easy to implement and provides the
developer with complete control and eliminates third parties
from interfering with the integrity of the software developer
and end user relationship.
According to one aspect of this invention, there is
provided a method of protecting computer software using a
combination of computer hardware and software comprising the
steps of: permanently establishing a first key in a hardware
device and storing a second key in said hardware device;
coupling said hardware device having said first key and said
second key stored therein to a computer utilizing software
which is desired to be protected; interrogating the hardware
device using an access sequence generated by the computer
software which is desired to be protected; generating outputs
from the hardware device indicative of said first key and said
second key; extracting a single control key by using an
algorithm which processes said first and second keys to
produce the same control key; and preventing the unauthorized
use of software desired to be protected using said control
key.
2051576
- 4 (a) -
According to another aspect of the present
invention, there is provided a combination of computer
hardware and software means for protecting computer software
comprising a hardware device having first and second sections
for generating first and second keys, respectively, coupled to
said computer operating on software that is desired to be
protected; means for permanently establishing said first key
in said first section of said hardware; software means for
providing an access sequence to said first and second sections
of said hardware means for generating said first and second
keys, respectively; and algorithm decoder means coupled to
said hardware means for decoding an algorithm using said first
and second keys and providing a control key output which is
used to protect said software.
According to yet another aspect of the present
invention, there is provided a method of protecting computer
software using a combination of computer hardware and software
comprising the steps of:
permanently establishing a first key in a hardware
device; providing and storing a second key in said hardware
device; plugging said hardware device having said first key
and said second key stored therein into a computer utilizing
software which is desired to be protected for establishing a
communications path between the hardware device and said
computer; interrogating said first and second keys in said
hardware device using an access sequence generated by the
computer software which is desired to be protected; generating
- 4 (b) - 2 05 15 7 6
output from the hardware device indicative of said first key
and said second key; extracting a single control key by
applying said first key and second key to an algorithm which
processes said first and second keys to produce a control key;
generating a plurality of second keys any of which when
processed by a given algorithm along with said first key
produce a corresponding control key; preventing the
unauthorized use of software desired to be protected using
said control key.
According to another aspect of the present
invention, there is provided a combination of computer
hardware and software means for protecting computer software
comprising a hardware device having first and second sections
for generating first and second keys, respectively, coupled to
said computer operating on software that is desired to be
protected; means for permanently establishing said first key
in said first section of said hardware; software means for
providing an access sequence to said first and second sections
of said hardware means for generating said first and second
keys, respectively; algorithm decoder means coupled to said
hardware means for decoding an algorithm using said first and
second keys and providing a control key output which is used
to protect said software; said second section of said hardware
device has a plurality of second keys each of which when
processed along with said first key by an algorithm decoder
means provides the said control key.
2051~7~
Brief Description of the Drawinqs
The invention, together with further objects, aspects,
features and advantages thereof will be more clearly understood
from the following description taken in connection with the
accompanying drawings.
Fig. 1 is a block diagram of the computer software
protection system in accordance with the present invention.
Fig. 2 is a block diagram of a modification of the
computer software protection apparatus having a multiplicity of
second keys.
Fig. 3 is a block circuit diagram illustrating a more
detailed embodiment illustrating the first and second keys
utilized in combination with an algorithm to provide a control
key in accordance with the present invention.
Description of the Preferred Embodiments
Referring now to Fig. 1, a hardware security device,
referred to generally with the reference numeral 10, comprises
two sections 12 and 18. Section 12 contains a first key 13 in
the form of a code Kx and a second key 20 containing yet another
code Ka. The hardware device is coupled to computer and
software 1 which provides an access sequence to the hardware
2~51~i7~i -
security device 10. When the software is run in the computer,
appropriate access sequences 2 and 3 are issued to the first key
13 and the second key 20, respectively, providing outputs 4 and
5 which are indicative of the codes Kx and Ka, respectively.
The outputs 4 and 5 representing Kx and Ka, respectively, are
applied to the algorithm decoder 6 producing a resultant control
key 7 represented by Kxa which is used and further manipulated
by normal means as previously disclosed in the prior art to
allow authorized access to the protected portion of the software
which is desired to be protected.
The control key 7, Kxa, is the resultant of an
algorithm and two other keys, namely, Kx and Ka. The control
key 7 Kxa does not exist in precoded form, but only as a
derivation from the two other keys and an algorithm. For
purposes of security, Kx must reside in the supplied hardware 10
under the control of the developer, whereas, Ka, may reside in
the supplied hardware security device 10, but is not restricted
thereto. For example, Ka may be entered through a separate port
such as that which connects the keyboard to the computer. The
algorithm can also be included in any part of the software, the
computer hardware or any combination thereof.
Assuming that the algorithm function is a simple
exclusive OR, Table I illustrates several values of Kx and Ka,
which if XOR'ed will yield the same Kxa.
2051576
TABLE I
KxO = 1101 K~O = 100~
Kxl = 1011 K-l = 1111
Kx2 = 0110 K~2 = 0010
K)~-- =
0100
KYn = lnln ~ n
Since the control key 7 is constant Kxa, it will be
apparent that identical software keyed to Kxa will always run
with any identical Kxa. Since other combinations of Kx and Ka
will produce the same Kxa as illustrated in this example, many
apparently different keys will operate the identical software.
From the simple four bit illustration for Kx there are only 24
or 16 such keys out of a possible 256 combinations of eight
bits. Other combinations and limitations can be chosen by
design.
It will be appreciated that the previous example which
employs four bits for the first key Kx and the second key Ka are
merely chosen for purposes of understanding and are not to be
construed as any limitation on the invention. Furthermore, the
particular algorithm 6 namely, XOR'ing the first and second keys
13 and 20 is merely chosen for purposes of illustration and does
not constitute a limitation on the present invention. There are
literally an infinite number of algorithms which can produce the
-- 8
2051S7~
desired results, and the complexity or simplicity of the choice
of the algorithm is left to its designer. In designing systems
to be effective, at least one section 12 or 18 of the security
device 10 must not be easily duplicated or emulated. Simply as
illustrative, this portion is designated as section 12 which
contains a hardware coded element 13 which effectively yields
the code Kx when interrogated by the access sequence 2. To
prevent tampering by the end user, Kx should remain permanent
once established. In addition, to reduce the possibility of
emulating the access sequence 2 in producing the response 7 by
some other device or circumvention directly through the software
means, the algorithm for extracting the code from Kx should be
complex. However, the value or code Kx must remain readable and
not secret in order to provide protection to many non-identical
groups of software discussed hereinafter. In addition, the
function of the algorithm should be made kept secret and complex
to prevent reverse engineering. Finally, there must be a
sufficient number of possible but invalid combinations of Ka for
each value of Kx to prevent trial and error searches for Kxa
within a practical length of time.
If Kx cannot be changed but can be read, the complex
algorithm and the required value Kxa remains secret, and the
number of combinations of Ka large, then the probability of
determining the necessary value of Ka to operate the software
within a reasonable length of time become prohibitive. Based on
this assumption, the contents of Ka may be altered and may be
allowed to be altered without regard to security. There will be
20~1~i76
at least one value of Ka for each given value of Kx that will
operate the software. However, the possible number of Ka values
must be large so that trial and error efforts to determine the
value of Ka will be impractical.
Referring now to Fig. 2, instead of providing a single
value Ka 20 stored in section 18, section 18 is provided with a
plurality of elements 22, 24, 26, etc. providing a plurality of
storage areas needed to store keys Ka through Kn, one for each
protected application module, access, etc. for the software.
Assuming that it is possible to freely read and write
information to and from one of the areas 22, 24, etc., it will
be apparent that the stored values, for example, Kb and Kc can
provide two new keys Kxb and Kxc, which can be made available
for other applications such as additional software, modules,
etc. Table II below illustrates that each value of ~x (KxO,
Kxl, and Kx2), a different value of Kb (KbO, Kbl, and Kb2) is
required to produce a given key Kxb and similarly, for Kxc.
Table II
KxO = 1101 K~O = 0110 KcO = 1100
Kxl = 1011 K~l = 0000 Kcl = 1010
Kx2 = 0110 K!~2 = 1101 KC2 = 0111
Kxb = ~<xc =
~011 0001
K--n = lnln Kt.n = 0001 K~n = 1011
-- 10
2051~76
It will be appreciated that when different Ka through
Kn are used different algorithms may be employed for each Ka
through Kn giving a different but particular control key for
each Kxa through Kxn.
Fig. 3 illustrates an example of a single
implementation using a four bit code for Kx, and Ka through Kn.
A battery 11 is coupled to elements 14, 15, 16 and 17 of section
12 as illustrated producing the Kx code 13 of 1101 representing
bit 3 through bit 0, respectively. In Fig. 3, the output Kx is
illustrated as a parallel output which can also be represented
by serial outputs by sequential selection. The battery 11 is
also connected to section 18 as shown. Code 20 (Ka) is formed
by elements 21, 23, 25 and 27 while code 26 (Kn) is formulated
by elements 28, 29, 30 and 31. For Ka, the four bit code is
1001 while for Kn, the code is 0011. The individual elements 14
through 17 of section 12 as well as 21, 23, 25 and 27 of Ka 20
and 28 through 31 of Kn 26 are all individual elements which can
be wire, memory cells, flip-flops, storage register element
cells, programmable memory cells, etc. Any of these elements
may be utilized to provide the desired code which has been
selected in accordance with the particular design utilized to
carry out the present invention. The outputs from section 18
are provided by a gang switch 32 to provide Ka through Kn
outputs. The outputs can further be selected by means of a
multiplex switch which are controlled by addressing methods
common in computer hardware.
205157~
Accordingly, the problem of distributing protected
software is ameliorated by the present invention. Identical
packs of protected software may be mass replicated and released
with a hardware security device 10 with Kx in Section 12
supplied with random values. Corresponding areas of section 18
are loaded with the corresponding correct values of Ka through
Kn for each given Kx providing the appropriate key values Kxa
through Kxn, each such control key being used for a
corresponding piece of software desired to be protected. At any
time that it is desired to allow access to another additional
section of software, it is only necessary to load an appropriate
value into the key area that corresponds to this additional
software. The value of Kx is read and transferred to the
software developer which may be necessary if Kx has been
distributed at random, who can then provide the matching correct
code Ka through Kn for each additional software module that is
needed to be operative. This step can easily be performed by
telephone eliminating the need to ship software or additional
keys.
To prevent additional unauthorized activation of the
software through the duplication of the contents of memory of
the elements Ka through Kn from a sister device which has been
authorized and with the proper codes Ka through Kn implanted, it
is necessary to create a unique value of Kx for every hardware
device so that no identical twin(s) exists. This can readily be
accomplished through ordinary means if EPROM's or similar
storage devices are used and is only slightly more inconvenient
205157~
than programming Kx with the same value. As a practical matter,
Kx does not have to have an infinite number of values as chance
of finding the same key is improbable.
However, if the value of Kx is truly unique, such that
only one value exists for a given piece of software, then Kx can
readily be a substitute for serialization of software itself
which make replication of the software a simple process.
Additionally, it would be unnecessary to mail in a confirmation
of the registration. The software can be made to run only upon
receipt of the necessary value of Ka, Kb, Kc, etc. which can
only be obtained from the developer and only after all pertinent
facts have been given at the request of the developer.
Accordingly, the developer has complete control over the
licensing of the software eliminating third parties from
interfering with the integrity of the software developer and the
end user relationship. It is understood that for purposes of
this disclosure, software will include data files, applications,
netwear, operating systems, etc. which are to be protected using
this invention.
Since other changes and modifications varied to fit
particular operating requirements and environments will be
apparent to those skilled in the art, the invention is not
considered limited to the examples chosen for purposes of
illustration, and includes all changes and modifications which
do not constitute a departure from the true spirit and scope of
this invention as claimed in the following claims and
equivalents thereto.
